Compromising Threat Actor Communications

Infostealers are among the most common malware families, and many of them send stolen data through trusted platforms such as Telegram rather than servers the attacker runs. The talk explains why this is attractive to criminals and how a bot token and chat ID embedded in a sample can be used to find the bot's groups and forward messages from a criminal's chat into one the researcher controls.

The speaker works through a live case that began with a phishing email carrying an archive with a script. The script fetched a PowerShell loader that dropped a .NET binary, which started a legitimate Windows utility in a suspended state and injected a Nova infostealer payload. Its configuration held Telegram credentials. Mirroring the operator's chat exposed screenshots and keylogs from victims, along with the operator's own infrastructure: purchased domains, Cloudflare and SSH logins, and panel credentials stored in plain text. The chat also showed mass mail campaigns and other malware and credential harvesting activity.

The main takeaway is that operator mistakes such as hardcoded tokens, reused or exposed credentials, and unchanged default hostnames can produce intelligence and high-fidelity detections. Defenders can look for Telegram API traffic in sandbox or VirusTotal telemetry to surface bot tokens quickly. The closing questions covered how many victims were involved and whether the operator could see the researcher's actions, with the speaker noting that a group admin can hide the bot's identity.